3) Going a little further it would be great to setup PSA so that when a new system user is created it adds them to the RBAC for that group so that httpd processes can be limited by roles for a group rather then per user. It would also be nice if you could tie this into some kind of resource management so that users in that group cant have processes that use more then X amount of resources - although Im not sure if that would be better suited for something like PAM even though the users never get a shell.